SP rule for limiting the number of attribute values

[Martin Haase]

Hi Paul,

are you aware of the exportDuplicateValues content setting?
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334723/ContentSettings

That might help at least when the values are the same.

Cheers

Martin

On 19.01.24 15:54, Paul Caskey wrote:
>
> Hi Everyone-
>
>  
>
> We occasionally receive assertions which contain multi ePPN
> attributes.  Usually, they are the same value, but our apps receive
> them as multi-valued (e.g. value at domain.edu;value at domain.edu).
>
>  
>
> I know this is an IdP configuration problem, but we have apps that
> assume ePPN to be single-valued (as the spec for that says), so we’d
> like to limit the SP to presenting only one value to the apps.
>
>  
>
> We’ve tried to use a PermitValueRule for this and we’ve tried a few
> different things, but we always seem to end up with no ePPN values
> seen by the apps.
>
>  
>
> Here’s the one we’ve tried that seems like it should work since it
> follows other similar examples in the attribute-policy.xml file:
>
>  
>
>    <PermitValueRule id="SingleValue">
>
>         <Rule xsi:type="NumberOfAttributeValues" minimum="1" maximum="1"/>
>
>     </PermitValueRule>
>
> ….
>
>         <AttributeRule attributeID="eppn">
>
>             <PermitValueRule xsi:type="AND">
>
>                <RuleReference ref="ScopingRules"/>
>
>                <RuleReference ref="SingleValue"/>
>
>             </PermitValueRule>
>
>         </AttributeRule>
>
>  
>
> Can anyone point us in the right direction?
>
>  
>
>  
>
> TIA,
>
> -Paul
>
>
-- 
Dr. Martin Hitschel, Senior Consultant

DAASI International
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: martin.hitschel at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240122/36fd59d6/attachment.htm>